Mattias Geniar:
A lot of (web) developers use a local .dev TLD for their own development. … In those cases, if you browse to http://site.dev, you’ll be redirect[ed] to https://site.dev, the HTTPS variant.
That means your local development machine needs to;
- Be able to serve HTTPs
- Have self-signed certificates in place to handle that
- Have that self-signed certificate added to your local trust store (you can’t dismiss self-signed certificates with HSTS, they need to be ‘trusted’ by your computer)
This is probably generally A Good Thing™, but it is a little obnoxious to be forced into it on Chrome. They knew exactly what they were doing when they snatched up the .dev TLD. Isn’t HSTS based on the entire domain though, not just the TLD?
